[papegaaij]

Maven 3.10.0 is based on Maven Resolver 2.0 (2.0.24) instead of 1.9, so the
dependabot bumps fail CI (#571, #573, #552). This PR does the full upgrade and
supersedes #571, #573, #570 and #552.

Changes

• Maven 3.10.0, MIMA 3.0.1 (Resolver 2.0.24 based), Sisu 1.1.0
• maven-resolver-transport-http no longer exists in Resolver 2, replaced by
  maven-resolver-transport-apache (same as Maven 3.10 and MIMA standalone)
• Embedded Maven default version and the build wrapper use 3.10.0

Behaviour fixes needed for Resolver 2 / Maven 3.10

• Resolution order: Resolver 2 defaults to level-order (breadth-first).
  ShrinkWrap keeps pre-order (depth-first) by default, so asFile() order is
  unchanged. -Daether.system.dependencyVisitor=levelOrder opts in. Covered by
  the new ResolutionOrderTestCase.
• Resolver 2.0.24 bug: DependencyFilter.accept(node, parents) receives
  the node itself as the first element of parents (and not the root), because
  Stack.head() drops the wrong end. This broke all ancestor based
  MavenResolutionFilters (DependencyDepthTestCase, PomFilteringUnitTestCase).
  MavenResolutionFilterWrap now skips the node itself.
• Model building: Maven 3.10 treats every model built with a validation
  level below 2.0 as an external model from a repository, disabling file based
  profile activation and restricting interpolation. loadPomFromFile now uses
  VALIDATION_LEVEL_MAVEN_2_0 (ProfilesUnitTestCase.testActiveProfileByFile).
• Thread safety: Resolver 2 collects dependencies in parallel (BF
  collector), which made ClasspathWorkspaceReader fail intermittently with
  FWK005 parse may not be called while parsing. findArtifact is now
  synchronized.

Behaviour changes for users

• The Maven plugin requires Maven 3.10.0+ (MIMA 3 uses Resolver 2 APIs).
• System scoped dependencies of POMs resolved from a repository are no longer
  interpolated (Maven 3.10 security hardening). Opt out with
  -Dmaven.model.dependencyInterpolation.full=true; the test now covers both.
• shrinkwrap-resolver-impl-maven now brings slf4j-api 2.x transitively.

Cleanups (no user visible changes)

• Use the Path based Resolver 2 APIs instead of the deprecated File based
  ones (Artifact.getPath()/setPath(), RepositoryEvent.getPath(),
  LocalRepository(Path, String)). The public ShrinkWrap API still uses File.
• ConfigurableVersionSelector with the Nearest strategy replaces the
  deprecated NearestVersionSelector (same classic Maven conflict resolution).
• The deprecated scope selectors (JavaScopeSelector, ScopeDependencySelector,
  ...) are kept on purpose: their replacements are internal Resolver classes, and
  ShrinkWrap's arbitrary scope filtering does not map onto Resolver 2 resolution
  scopes.

Testing

• impl-maven: 4870 tests pass, dependencyConvergence passes
• impl-maven-archive, Embedded Maven (runs 3.10.0) and the Maven plugin
  invoker ITs pass
• Locally only on JDK 25; Gradle modules not verified locally

🤖 Generated with Claude Code